DNS and Search Engine Host Enumeration

[nberthaume at gmail.com (Nicholas B.)]

In the last few months there seems to have been a flood of new and
updated tools designed to at least in part provide host enumeration
without communicating directly with it.  While I appreciate all of
these I really don't have the time to test them all out and find what
is the best tool to start with when gathering this info without
actively scanning the target.  Where do you begin and how do you take
that information along to other tools once you have results (or lack
there of) from your initial batch of tools prior to directly engaging
the system(s)?  I've started out with tools as sophisticated as
maltego and as simple as nslookup for my testing in the past and I'd
appreciate how others approach this.

Thanks